Sample Questions
Question 1
Easy
Which activity best illustrates coaching as a development technique within an internal audit function?
Solution
D is correct. Coaching is the ongoing, individualized guidance a more experienced auditor provides while work is being performed, developing the staff auditor's judgment in real time and reinforcing it with constructive feedback. It differs from formal performance management, supervisory review, and structured training, all of which support competency development but operate before or after the work rather than alongside it.
Question 2
Medium
Which condition most warrants the chief audit executive's review and possible revision of the internal audit strategy?
Solution
A is correct. Standard 9.2 (Internal Audit Strategy) requires the chief audit executive to develop and periodically review a strategy that supports the organization's strategic objectives and stakeholder expectations. A shift in the organization's own strategy changes the risk profile the function must cover, the competencies and technology it needs, and the assurance stakeholders will expect, so it is the trigger that drives the strategy, the resource plan, and the multi-year coverage model to be reconsidered. Operational disruptions are absorbed through normal plan and resource management without revisiting the strategy itself.
Question 3
Hard
Eight unrelated engagements each produced a low-rated observation, all tracing to unauthorized changes reaching production. Process owners accepted each observation. What should the chief audit executive do?
Solution
A is correct. Standard 11.3 requires the chief audit executive to report periodically to senior management and the board on significant risk and control issues, and to identify themes emerging across engagements rather than only engagement-by-engagement results. Ratings assigned within a single engagement measure that engagement's scope; when the same root cause, unauthorized changes bypassing authorization controls, recurs across eight independent areas, the aggregate exposure is pervasive even though each instance was rated low. Process owners' acceptance of localized fixes does not dispose of an entity-level control breakdown, because no single owner can see or remediate the pattern. Escalating the theme lets senior management assign ownership of the underlying change management control and lets the board weigh the exposure against the organization's risk appetite.
